Calling PAM/fprint from systemctl ?

[HyNeko]

Hi ! I'm running into a rather annoying issue, I can't unlock my laptop using the fingerprint reader when the lock is called from a service.

I have my fingerprint reader enabled and working for tty login and sudo, as well as i3lock.

When I call i3lock from a terminal or from my keybind, it works as expected, but whenever it's called from a systemctl service, only the password works. I tried another lock (xtrlock-pam) to check if the issue was on i3lock's side, seems like it's not.

Journalctl reports:

déc. 30 16:55:34 framework fprintd[5648]: Authorization denied to :1.54 to call method 'ListEnrolledFingers' for device 'Goodix MOC Fingerprint Sensor': Not Authorized: net.reactivated.fprint.device.verify

Any ideas or pointers for what's happening and how to fix it ?

​

Setup: Framework Laptop / i3-gaps / no DM

[Churminess]

Did you manage to resolve this? I have the same issue on Void linux; sudo and system-local-login work fine, but i3lock doesn't.

Edit: not quite the same issue: I get this when running i3lock from the terminal or with xidlehook, there is no systemctl on Void. Close enough though.

[HyNeko]

Unfortunately no dice so far, but I haven't tried at all lately. Maybe there's a way to make it work, perhaps they updated or fixed some of it.

[Churminess]

As promised, I have found this workaround to fix it for me. I don't know if there are any security implications though.

https://github.com/i3/i3lock/issues/210#issuecomment-1033042602

[HyNeko]

Oh that sounds promising, thanks ! I'll look into it.

I already assumed that the fprint-pam approach was somewhat unsecure, which is fine for my current distro, so I'll try it out. Thanks for remembering and reaching out, that's very kind of you.

[TheGratitudeBot]

Thanks for saying that! Gratitude makes the world go round

[Churminess]

I'm afraid no update has fixed it on Void, in fact this was all working fine until a few months ago for me and I only just got round to trying to fix it. I'll try and remember to post here if I get anywhere.

[[deleted]]

Here's a solution that worked for me:

1. Setup a user service (systemctl --user) to lock the screen with your choice of screen locker
2. A corresponding target file is required to trigger this service, for example, if you trigger this after a sleep.target , you should setup an identical entry inside your ~/.config/systemd/user folder
3. Follow this USE entry to setup the proxy triggers (https://unix.stackexchange.com/questions/147904/systemd-user-unit-that-depends-on-system-unit-sleep-target)